cbcvebase.
CVE-2024-41051
published 2024-07-29

CVE-2024-41051: In the Linux kernel, the following vulnerability has been resolved: cachefiles: wait for ondemand_object_worker to finish when dropping object When queuing…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.27%
19.7th percentile
In the Linux kernel, the following vulnerability has been resolved: cachefiles: wait for ondemand_object_worker to finish when dropping object When queuing ondemand_object_worker() to re-open the object, cachefiles_object is not pinned. The cachefiles_object may be freed when the pending read request is completed intentionally and the related erofs is umounted. If ondemand_object_worker() runs after the object is freed, it will incur use-after-free problem as shown below. process A processs B process C process D cachefiles_ondemand_send_req() // send a read req X // wait for its completion // close ondemand fd cachefiles_ondemand_fd_release() // set object as CLOSE cachefiles_ondemand_daemon_read() // set object as REOPENING queue_work(fscache_wq, &info->ondemand_work) // close /dev/cachefiles cachefiles_daemon_release cachefiles_flush_reqs complete(&req->done) // read req X is completed // umount the erofs fs cachefiles_put_object() // object will be freed cachefiles_ondemand_deinit_obj_info() kmem_cache_free(object) // both info and object are freed ondemand_object_worker() When dropping an object, it is no longer necessary to reopen the object, so use cancel_work_sync() to cancel or wait for ondemand_object_worker() to finish.

Affected

17 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.106-1 (bookworm)linux 6.1.106-1 (bookworm)
debianlinux-6.1< linux 6.1.106-1 (bookworm)linux 6.1.106-1 (bookworm)
linuxlinux
linuxlinux>= 0a7e54c1959c0feb2de23397ec09c7692364313e < b26525b2183632f16a3a4108fe6a4bfa8afac6edb26525b2183632f16a3a4108fe6a4bfa8afac6ed
linuxlinux>= 0a7e54c1959c0feb2de23397ec09c7692364313e < 12e009d60852f7bce0afc373ca0b320f1415041812e009d60852f7bce0afc373ca0b320f14150418
linuxlinux>= 6.1.95 < 6.1.1006.1.100
linuxlinux>= 6.6.35 < 6.6.416.6.41
linuxlinux>= f17443d52d805c9a7fab5e67a4e8b973626fe1cd < ec9289369259d982e735a71437e32e6b4035290cec9289369259d982e735a71437e32e6b4035290c
linuxlinux>= f740fd943bb1fbf79b7eaba3c71eb7536f437f51 < d3179bae72b1b5e555ba839d6d9f40a350a4d78ad3179bae72b1b5e555ba839d6d9f40a350a4d78a
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.106-16.1.106-1
linuxlinux_kernel>= 0 < 6.9.10-16.9.10-1
linuxlinux_kernel>= 0 < 6.9.10-16.9.10-1
linuxlinux_kernel>= 0 < 6.8.0-48.486.8.0-48.48
linuxlinux_kernel>= 6.1.95 < 6.1.1006.1.100
linuxlinux_kernel>= 6.6.35 < 6.6.416.6.41
linuxlinux_kernel>= 6.8 < 6.9.106.9.10

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.